Reverse Engineer Browser Extensions for Security Audits

The skill is restricted to authorized use: it states explicitly that it is for educational purposes or authorized security assessments only, requires explicit written permission from the system owner before use, and treats misuse as illegal and strictly prohibited. Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target, it requires the user to state the exact target, confirm written authorization and scope, and explicitly confirm the shown commands - without that confirmation it stays read-only and offers defensive guidance only, preferring a sandbox or disposable VM.

Within that gate, it covers Chrome/Edge MV2/MV3 extension analysis, Firefox extensions, malicious-extension IOC and supply-chain extension-poisoning investigation, and recovering an extension's own signing, encryption, or proxying logic. The workflow has three phases: package analysis (unpack the .crx or pull the extension directory from a browser profile, inspect manifest.json for permissions, host_permissions, background, and content_scripts, and flag over-broad permissions like <all_urls>, webRequest, or debugger); logic analysis (examine the service_worker/background entry point, the content_script injection points and their isolated world, chrome.storage/IndexedDB for stored keys, and - shared with the js-reverse toolchain - observed network traffic and runtime.sendMessage message passing); and dynamic analysis (load the unpacked directory in developer mode, check errors at chrome://extensions, attach DevTools to the service worker, and use Frida or browser CDP tooling when needed). The toolchain pairs unzip/jq for the manifest, Chrome DevTools for worker debugging, the js-reverse toolchain for deep JavaScript analysis, and YARA for malicious-extension rules.

Use it for auditing a browser extension's behavior and permissions in an authorized review, or investigating how an extension handles credentials or sensitive page data. Do not run any probing, exploitation, or data-extraction command without the explicit written-authorization confirmation the gate requires; without it, stay read-only.

Input is the target extension's package (.crx or unpacked profile directory) and confirmed authorization scope. Output is a permission-surface and entry-point map, recovered data flows (storage keys, message passing, network calls), and, for malicious samples, IOCs and YARA-rule candidates. Downstream routing sends heavily obfuscated JavaScript to js-reverse and poisoning investigations to supply-chain/malware analysis.

Security reviewers conducting an authorized audit of a browser extension's permissions and data handling, or investigating a suspected malicious or supply-chain-poisoned extension.